Managing a Security Operations Center GSLC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC manager is designing the team structure for a 24/7 operation. The team will include Tier 1 analysts, Tier 2 analysts, and incident responders. Which responsibility should be assigned to Tier 1 analysts?

   • ADevelopment of detection rules
   • BFinal approval of incident closure
   • CForensic analysis of compromised systems
   • DInitial triage and validation of alerts
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC manager is comparing two metrics: mean time to detect (MTTD) and mean time to respond (MTTR). The manager notices that MTTD is low but MTTR is high. Which interpretation is most likely?

   • AThe SOC is understaffed, causing both detection and response to be slow.
   • BThe SOC is detecting incidents slowly but responding quickly.
   • CThe SOC has too many false positives, causing delays in detection.
   • DThe SOC detects incidents quickly but takes a long time to contain and remediate them.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC has been operating for a year and has established basic monitoring and incident response processes. The manager wants to move to a higher maturity level by implementing continuous improvement practices. Which practice would best support this goal?

   • AReplace the SIEM with a newer model every year.
   • BIncrease the number of monitored devices to expand coverage.
   • CConduct regular post-incident reviews to identify lessons learned and update processes.
   • DRequire all analysts to work overtime during peak periods.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC manager wants to measure the quality of the team's detection rules. Which metric is most appropriate?

   • ANumber of security incidents
   • BTime to patch vulnerabilities
   • CNumber of analysts on shift
   • DFalse positive rate
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SOC manager is reviewing monthly metrics. The SOC has a low MTTD but a high MTTR. The team is well-staffed and has good tools. Which interpretation is most likely?

   • AThe team is slow to detect incidents but responds quickly once detected.
   • BThe team is both fast to detect and fast to respond.
   • CThe team is both slow to detect and slow to respond.
   • DThe team detects incidents quickly but struggles to contain and remediate them efficiently.
   Reveal Solution Discussion Select an answer first